Washington State to roll-out insecure RFID technology in driver's licenses

["'Richard M. Smith'" <rms () computerbytesman com>]

Seesh.  Washington State wants to embedded insecure RFID tags in driver's
licenses.  The tags they've chosen can be cloned and read by anyone with the
appropriate reader unit.

Richard

http://www.rfidjournal.com/article/articleprint/3514/-1/1/

Washington Driver's Licenses to Carry EPC Gen 2 Inlays 

The state will issue the RFID-enabled driver's licenses on a voluntary basis
next year, to test if the technology can improve traffic flow across the
Canadian border.

By Mary Catherine O'Connor 

July 30, 2007-Washington State's Department of Licensing has decided to
deploy a technology trial of an RFID-enabled driver's license. The agency
says it will work with Digimarc, a Beaverton, Ore., provider of personal
identification systems for government and commercial applications, to
implement the pilot. 

In March of this year, Washington governor Christine Gregoire authorized the
department to design the specialized driver's license for border crossings
between the state and Canada. In addition to having an RFID inlay, the
license (which will be called an Identicard) will also possess a digital
watermark and other authenticators, and will give Washingtonians an
alternative to carrying U.S. passports at land border crossings between
Canada and Washington (see Washington Examines RFID for Licenses). 

Gigi Zenk, communications director for the Washington State Department of
Licensing, says that passive EPC Gen 2 UHF tags will be embedded in the
licenses used in the pilot project, which is expected to run until mid-2009.
The purpose of the pilot will be to test the RFID and other technological
features of the cards to ensure that they will work as expected. Details
regarding the pilot and the procedures pilot participants and border patrol
will take at the checkpoints have not yet been released, though the program
will be voluntary. Any Washington resident interested in obtaining an
RFID-enabled driver's license can apply forone; other residents will
continue to receive the standard license. 

The Western Hemisphere Travel Initiative (WHTI), enacted in response to the
9/11 terrorist attacks, will require U.S. citizens crossing land or sea
borders between the United States and Canada, Mexico, Bermuda and the
Caribbean to prove their identity by presenting a valid U.S. passport or a
People Access Security Service (PASS) card, which the U.S. Department of
Homeland Security (DHS) is developing as an alternative to passports. This
requirement may be enforced as early as Jan. 31, 2008. 

The DHS has preapproved the use of the RFID-enabled Washington State
driver's licenses as an alternative to showing a U.S passport or PASS card
at border crossings between Washington and Canada, as long as the cards
carry passive UHF EPC Gen 2 inlays, which the department has selected for
the PASS cards it plans to issue for land border crossings. This will allow
the Identicards to be readable by the same interrogators as those that will
be used to read PASS cards. 

In selecting EPC Gen 2 technology for the WHTI's PASS card program, the DHS
said the tags' 20 feet of read range could facilitate speedy verification of
PASS card carriers at borders. However, Congress has delayed funding the
program in reaction to concern over the lack of security features supported
on EPC Gen 2 RFID inlays, as well as the swiftness with which the DHS chose
the technology. 

Representatives of RFID technology vendors that manufacture high-frequency
(HF) RFID inlays-which have a very short read range, but also support
anticloning and other security features the EPC UHF inlays lack-have been
lobbying Congress to push for technology trials to compare EPC inlays with
HF tags before the department rolls out the PASS cards to citizens (see RFID
Vendors Brief Congress on PASS Card Security). Opponents say that EPC tags'
lack of security could lead to the tags being read by unauthorized parties,
who could then encode the card's unique ID number onto a fraudulent ID. 

Digimarc, which provides Washington's current driver's licenses, says that
as part of its Identicard issuing process, it will compare facial biometric
scans of applicants to ensure that no individual will be able to apply for
and receive more than one card. It also notes that all Identicards will be
manufactured at a centralized, secure facility, ensuring that RFID and other
security features on the cards are controlled throughout the
card-manufacturing process. 


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.